Manager, Cyber Architecture, Strategy & Design

Summary

The Manager, Cyber Architecture, Strategy & Design is the lead role in defining and assessing Teck's security strategy, architecture and practices. They will be required to effectively translate business objectives and risk management strategies into specific security processes enabled by security technologies and services across both IT and Industrial OT environments.

The Manager will be an advocate of security requirements and objectives with constituencies, while also ensuring that security architecture and practices do not infringe on the needs of the business. Specifically, they will serve as the technical sounding board for the CISO's interaction with other line-of-business constituencies across Teck. The successful Manager is encouraged to evaluate new services, vendors, applications and security tools, among other items, from a technical perspective and translate the risk characteristics of these activities and functions into enterprise risk terms that the CISO can communicate to their colleagues.

Responsibilities

• Be a courageous safety leader, adhere to and sponsor safety and environmental rules and procedures
• Develop and maintain a security architecture process that enables the enterprise to develop and implement security solutions and capabilities that are aligned with business, technology and threat drivers across both IT and OT environments.
• Develop security strategy plans and roadmaps based on sound enterprise architecture practices.
• Develop and maintain security architecture artifacts (models, patterns, templates, standards and procedures) that can be used to leverage security capabilities in projects and operations.
• Track developments and changes in the digital business and threat environments to ensure that these are adequately addressed in security strategy plans and architecture artifacts.
• Participate in application and infrastructure projects to provide security planning advice.
• Draft security procedures and standards to be reviewed and approved by executive management and / or formally authorized by the CISO or the individual responsible for overall security direction.
• Identify baseline security configuration standards for operating systems (e.g., OS hardening), network segmentation, and identity and access management (IAM).
• Develop standards and practices for data encryption and tokenization within Teck based on our data classification criteria.
• Conduct threat modeling of services and applications that tie to the risk and data associated with the service or application.
• Conduct security assessments of internal systems, applications and IT infrastructure as part of the overall risk management practice of the organization.
• Participate in vulnerability assessments and other security reviews of systems, and prioritize remediation based on the risk profile of the asset and guidance from the CISO or other executive management.
• Conduct application reviews to determine security flaws or other issues that would impact the confidentiality, integrity or availability of the system.
• Coordinate with DevOps teams to advocate secure coding practices and raise concerns related to poor coding practices to the CISO or the individual responsible for the overall security direction.
• Coordinate with the privacy officer to detail data flows of sensitive information within the organization (e.g., PII or ePHI) and recommend controls to ensure this data is adequately secured (e.g., encryption, tokenization, etc.).
• Validate IT and Cloud infrastructures and other reference architectures for security best practices, and recommend changes to improve security and reduce risk where applicable.
• Validate security configurations and access to security infrastructure tools, including firewalls, intrusion prevention systems (IPS), web application firewalls (WAF), anti-malware / endpoint protection systems, etc.
• Review network segmentation to ensure zero-trust / least privilege for network / cloud access.
• Conduct reviews of and supervise the change management function for security rule sets.
• Liaise with the internal audit (IA) team to review and evaluate the design and operational effectiveness of security-related controls.
• Support the testing and validation of internal security controls as advised by the CISO or IA team.
• Review security technologies, tools and services, and make recommendations to the broader security team for their use based on security, financial and operational metrics.
• Coordinate with operational and facility-management teams to assess the security of operational technology and Internet of Things (IoT) systems.
• Liaise with other security architects and security practitioners to share standard methodologies and insights.

Qualifications

About Teck

At Teck, we value diversity. Our teams work collaboratively and respect each person's unique perspective and contribution.

Qualified applicants interested in joining dynamic team are encouraged to submit a resume and cover letter electronically.